申请ID：zusheng
个人邮箱：1370078017@qq.com
看雪下载的一个CrackMe，以下是学习笔记，用来申请邀请码
首先运行程序得到错误信息。Incorrect!,TryAgain.
好了用W32dsm载入 ，然后 右键 Find Text，输入incorrect 点查找
好了，记下此时的地址：
用od载入 Ctrl + G 输入刚才找到的地址
好了，我们上下看看！嘿嘿，错误信息在这里，那么估计重要的东西就在附近了好了找到这个段的开头！ F2下断！ 从新载入程序 F9运行 输入用户名和密码点Check
然后停留在我们所下的断点这里！
我们往下分析。。。。。。。。来到这里 004015C7 |> /8B55 E0 /MOVEDX,DWORD PTR SS:[EBP-20] 004015CA |.|83C2 01 |ADD EDX,1 004015CD |.|8955 E0 |MOV DWORD PTRSS:[EBP-20],EDX 004015D0 |> |8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] 004015D3 |. |3B45 E4 |CMP EAX,DWORD PTR SS:[EBP-1C] ; 密码长度是否大于0 004015D6 |. |7D 42 |JGE SHORT CHAP204.0040161A 004015D8 |. |8B4D E0 |MOV ECX,DWORD PTR SS:[EBP-20] 004015DB |. |51 |PUSH ECX ; /Arg1 004015DC |. |8D4D EC |LEA ECX,DWORD PTR SS:[EBP-14] ; | 004015DF |. |E8 1C030000 |CALL CHAP204.00401900 ; \读取第一个字符到eax { 00401900 /$ 55 PUSH EBP 00401901 |. 8BEC MOV EBP,ESP 00401903 |. 51 PUSH ECX 00401904 |. 894D FC MOV DWORD PTRSS:[EBP-4],ECX 00401907 |. 8B45 FC MOV EAX,DWORD PTRSS:[EBP-4] 0040190A |. 8B08 MOV ECX,DWORD PTRDS:[EAX] ; 取用户名到ecx中 0040190C |. 8B55 08 MOV EDX,DWORD PTRSS:[EBP+8] ; edx=0 0040190F |. 8A0411 MOV AL,BYTE PTRDS:[ECX+EDX] 00401912 |. 8BE5 MOV ESP,EBP 00401914 |. 5D POP EBP 00401915 \. C20400 RETN 4 } 004015DF |. E8 1C030000 |CALL CHAP204.00401900 ; \读取第一个字符到eax 004015E4 |. 0FBED0 |MOVSX EDX,AL ; 此时将eax高位清零，得用户名的第一个字符 004015E7 |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10] ; 81276345 004015EA |. 03C2 |ADD EAX,EDX ; 81276345 +a 004015EC |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX 004015EF |. 8B4D E0 |MOV ECX,DWORD PTR SS:[EBP-20] ; ecx=0 004015F2 |. C1E1 08 |SHL ECX,8 ; ecx*8 004015F5 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] ; edx=a 004015F8 |. 33D1 |XOR EDX,ECX 004015FA |. 8955 F0 |MOV DWORD PTR SS:[EBP-10],EDX 004015FD |. 8B45 E0 |MOV EAX,DWORD PTR SS:[EBP-20] 00401600 |. 83C0 01 |ADD EAX,1 00401603 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] ; ecx =8 密码长度 00401606 |. 0FAF4D E0 |IMUL ECX,DWORD PTR SS:[EBP-20] 0040160A |. F7D1 |NOT ECX 0040160C |. 0FAFC1 |IMUL EAX,ECX 0040160F |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] 00401612 |. 0FAFD0 |IMUL EDX,EAX 00401615 |. 8955 F0 |MOV DWORD PTR SS:[EBP-10],EDX 00401618 |.^ EBAD \JMP SHORT CHAP204.004015C7 这个部分为算法部分，大家可以根据我写的算法来来这里的算法！ 0040161A |> 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; 取结果到eax中 0040161D |. 50 PUSH EAX 0040161E |. 68 54404000 PUSH CHAP204.00404054 ; ASCII "%lu" 00401623 |. 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24] 00401626 |. 51 PUSH ECX 00401627 |. E8 52070000 CALL <JMP.&MFC42.#2818> 0040162C |. 83C4 0C ADD ESP,0C 0040162F |. 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24] 00401632 |. E8 79020000 CALL CHAP204.004018B0 00401637 |. 50 PUSH EAX ; /Arg1 00401638 |. 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18] ; | 0040163B |. E8 80020000 CALL CHAP204.004018C0 ; 关键Call 跟进去看 { 004018C0 /$ 55 PUSH EBP 004018C1 |. 8BEC MOV EBP,ESP 004018C3 |. 51 PUSH ECX 004018C4 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX 004018C7 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 004018CA |. 50 PUSH EAX ; /Arg2 004018CB |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4] ; | 004018CE |. 8B11 MOV EDX,DWORD PTR DS:[ECX] ; | 004018D0 |. 52 PUSH EDX ; |Arg1 004018D1 |. E8 0A000000 CALL CHAP204.004018E0 ; \CHAP204.004018E0 004018D6 |. 83C4 08 ADD ESP,8 004018D9 |. 8BE5 MOV ESP,EBP 004018DB |. 5D POP EBP 004018DC \. C2 0400 RETN 4 004018DF CC INT3 004018E0 /$ 55 PUSH EBP 004018E1 |. 8BEC MOV EBP,ESP 004018E3 |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 004018E6 |. 50 PUSH EAX ; /s2 004018E7 |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8] ; | 004018EA 51 PUSH ECX 004018EB |. FF15 B4314000 CALL DWORD PTRDS:[<&MSVCRT._mbscmp>] ; \_mbscmp 明码比较 看寄存器得知我们的密码为多少！ 004018F1 |. 83C4 08 ADD ESP,8 004018F4 |. 5D POP EBP 004018F5 \. C3 RETN } 00401640 |. 85C0 TEST EAX,EAX 判断是否用户名转化后的和输入的密码是否相等 00401642 |. 0F85 FF000000 JNZ CHAP204.00401747 关键跳，我们要爆破的话就改为如下 //00401642 /0F84 FF000000 JE CHAP204.00401747 则可以成功~ 00401648 |. 8D8D ACFEFFFF LEA ECX,DWORD PTR SS:[EBP-154] 0040164E |. E8 19070000 CALL <JMP.&MFC42.#540> 00401653 |. C645 FC 03 MOV BYTE PTR SS:[EBP-4],3 00401657 |. 6A 66 PUSH 66 00401659 |. 8D8D ACFEFFFF LEA ECX,DWORD PTR SS:[EBP-154] 0040165F |. E8 02070000 CALL <JMP.&MFC42.#4160> 00401664 |. B9 07000000 MOV ECX,7 00401669 |. BE 58404000 MOV ESI,CHAP204.00404058 ; ASCII "Correct!! " 0040166E |. 8DBD 48FEFFFF LEA EDI,DWORD PTR SS:[EBP-1B8] 00401674 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00401676 |. 66:A5 MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] 00401678 |. A4 MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] 00401679 |. B9 11000000 MOV ECX,11 0040167E |. 33C0 XOR EAX,EAX 00401680 |. 8DBD 67FEFFFF LEA EDI,DWORD PTR SS:[EBP-199] 00401686 |. F3:AB REP STOS DWORD PTR ES:[EDI] 00401688 |. AA STOS BYTE PTR ES:[EDI] 00401689 |. B9 07000000 MOV ECX,7 0040168E |. BE 78404000 MOV ESI,CHAP204.00404078 ; ASCII"<BrD-SoB> " 00401693 |. 8DBD 14FFFFFF LEA EDI,DWORD PTR SS:[EBP-EC] 00401699 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0040169B |. 66:A5 MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] 0040169D |. B9 11000000 MOV ECX,11 004016A2 |. 33C0 XOR EAX,EAX 004016A4 |. 8DBD 32FFFFFF LEA EDI,DWORD PTR SS:[EBP-CE] 004016AA |. F3:AB REP STOS DWORD PTR ES:[EDI] 004016AC |. 66:AB STOS WORD PTR ES:[EDI] 004016AE |. B9 06000000 MOV ECX,6 004016B3 |. BE 98404000 MOV ESI,CHAP204.00404098 ; ASCII "Incorrect!!, TryAgain." 004016B8 |. 8DBD 78FFFFFF LEA EDI,DWORD PTR SS:[EBP-88] 004016BE |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004016C0 |. B9 13000000 MOV ECX,13 004016C5 |. 33C0 XOR EAX,EAX 004016C7 |. 8D7D 90 LEA EDI,DWORD PTR SS:[EBP-70] 004016CA |. F3:AB REP STOS DWORD PTR ES:[EDI] 004016CC |. B9 07000000 MOV ECX,7 004016D1 |. BEB0404000 MOV ESI,CHAP204.004040B0 ; ASCII "Correct way to go, You Got It.
下面c++写得注册机源码 [C++] 纯文本查看 复制代码 #include <stdio.h>
#include <string.h>
#define SIZE 20
void main()
{
int i,j,k,max;
unsigned long b=0x81276345;
char a[SIZE]="";
printf("please input you CodeName\n");
scanf("%s",a);
for (i=0;i<(max=strlen(a));i++)
{
b=a[i]+b;
j=i;
//j*=256;;
j=j<<8;
b^=j;
k=i;
k+=1;
b=b*(~(max*i))*k;
}
puts("this is your code");
printf("%u\n",b);
getchar();
getchar();
}
作者：zusheng 本文章用于申请吾爱破解论坛邀请码，未经允许静止转载。 | 
吾爱游客
发表于 2014-11-28 20:55
发表于 2014-11-29 23:04
